IDApplicationProtector12IDSecuritySuite

Hunt Hypothesis

This rule identifies the presence of ID Application Protector 12, a security suite component that may indicate specific endpoint protection deployments or potential persistence mechanisms on Azure-hosted workloads. Proactively hunting for this signature allows the SOC to verify the integrity of installed security agents and detect unauthorized or outdated versions that could create gaps in the defense-in-depth strategy.

YARA Rule

rule IDApplicationProtector12IDSecuritySuite
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED F2 0B 47 00 B9 19 22 47 00 81 E9 EA 0E 47 00 89 EA 81 C2 EA 0E 47 00 8D 3A 89 FE 31 C0 E9 D3 02 00 00 CC CC CC CC E9 CA 02 00 00 43 3A 5C 57 69 6E 64 6F 77 73 5C 53 6F 66 74 57 61 72 65 50 72 6F 74 65 63 74 6F 72 5C }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: The IDAppProtectorService.exe or related helper binaries are executed by the ID Security Suite installation wizard or the ID Application Protector agent during initial deployment or major version upgrades. This often occurs when IT administrators run the installer via Group Policy Preferences (GPP) or SCCM/MECM task sequences, triggering the YARA match on the executable path or memory signature.

  • Filter/Exclusion: Exclude processes where the parent process is msiexec.exe, setup.exe, or IDAppProtectorInstaller.exe, or filter by file path containing \ID Security Suite\ or \IDAppProtector\ if the rule matches the binary itself rather than its behavior.

• Scenario: The ID Application Protector agent performs routine integrity checks or policy enforcement actions, spawning short-lived child processes (e.g., IDAppProtectorHelper.exe or IDPolicySync.exe) to communicate with the ID Security Console or local policy store. These legitimate service threads may be misidentified as suspicious if the YARA rule triggers on specific API calls or memory patterns associated with the agent’s internal synchronization tasks.

  • Filter/Exclusion: Exclude processes running under the SYSTEM or IDAppProtectorService account name, or filter by command line arguments containing --sync, --policy-check, or --integrity to distinguish background maintenance from interactive user sessions.

• Scenario: Enterprise backup solutions like Veeam, Commvault, or Windows Server Backup create shadow copies or temporary extraction folders for the ID Security Suite binaries during scheduled backup jobs. If the backup agent extracts or scans the ID Application Protector binaries into a temp directory (e.g., C:\ProgramData\Backup\Temp\), the YARA rule may match the static binary in the temp location, creating a false positive